ssh ciphers issue JIRA and Confluence

[Navadeep]

Hi ,

We have successfully migrated and upgraded JIRA and Confluence applications to latest versions. JIRA(7.4.1) and Confluence(6.2.4) in DEV Environment.

We have not used a secure connection(https) as we are in DEV environment.

After the applications were successfully upgraded to the latest available versions, we need to have a scan of the application servers by the network team here.

Below is the response from our network team after the security scan of the JIRA and Confluence application servers.

#############################################################

The following ssh ciphers were marked as an issue:

• arcfour
• arcfour128
• arcfour256

I have personally never seen these ciphers before and they have never come up on any scans we have done in the past so it could be something that the application setup which needs to be verified because if that is not the case I will need to remove them. If the application did install them than we need a validation of why they are required which will have to be signed off by security.

#############################################################

Thanks,

Nav

[Daniel Eads _unmonitored account_]

Hi Nav,

JIRA/Confluence installs don't modify openssh. Those ciphers weren't enabled or modified by Atlassian applications, so you should be able to disable them without adversely affecting your application installs.

I can't advise you specifically on how to disable those ciphers as I don't know what distribution you're running, but it should be easy enough to Google for your distribution + "disable arcfour cipher".

Good luck!

[Nic Brough -Adaptavist-]

It's not clear what was tested here.  If you're just using JIRA and Confluence on http though, it could not have been them.

For most ssh daemons, look in the sshd_config , found typically in /etc/ssh/ .   You should probably check ssh_config while you're there too.

If it is the JIRA/Confluence you need to check, then you will either need to look at the proxy you have in front of them, or the Tomcat "connector" settings in server.xml